Note on data protection

Safe!hints is our whistleblowing system. Employees, customers, business partners or other whistleblowers can use safe!hints to report suspected violations of laws and internal rules to the internal reporting centre. Safe!hints is part of our compliance management system.

Who is responsible for data processing?

The controller for the processing of your personal data is (hereinafter also referred to as the organisation):

Holding company of the Blumenbecker Group, B+M Blumenbecker GmbH, Postfach 12 51, Sudhoferweg 99-107, 59269 Beckum, represented by Dipl.-Kfm. Richard Mayer, Dipl.-Ing. Harald Golombek and Olaf Lingnau.

In accordance with our legal obligations, we have appointed a data protection officer who you can contact at any time with questions about data protection. You can reach him/her at

Biehn & Professionals GmbH

Wiesenstraße 32

33397 Rietberg - Mastholte

Telephone: +49 (0) 2944 - 979 71 - 0

E-mail: datenschutz@blumenbecker.com

What data is processed? 

When violations are reported via "safe!hints", personal data (e.g. name, contact details, photos, reported facts, etc.) of the person submitting the report (hint) is processed.

• the person submitting a report (whistleblower)
• the person affected by a report (reported person)
• and the other persons named in a report (e.g. witnesses/third parties)

who are entered in the respective notification form. 

What do we process your data for and on what legal basis? 

The above-mentioned data is processed for the purpose of detecting and preventing serious misconduct and avoiding and defending against particularly drastic or existence-threatening legal consequences and damage both for our organisation (criminal prosecution, claims for damages, reputational damage, supervisory measures) and for our employees.

The legal basis for the processing is the fulfilment of a legal obligation pursuant to Art. 6 para. 1 lit. c GDPR in conjunction with. § 10 HinSchG. In the case of a notification under the LkSG, the processing is lawful because it is necessary for the fulfilment of a legal obligation pursuant to Art. 6 para. 1 lit. c GDPR in conjunction with Section 8 LkSG. § 8 LkSG is required.


Who will receive my data?
As part of the audits, investigations and remedial measures to be taken, it may be necessary to transmit information on a reported incident to external advisors (e.g. legal advisors) or to the competent authorities. Personal data will only be disclosed if this is permitted under Section 9 HinSchG. 

The infrastructure of the system, including websites and database, is operated by Biehn & Professionals GmbH, Wiesenstraße 32, 33397 Rietberg-Mastholte, Germany, on our behalf in accordance with Art. 28 GDPR, which in turn uses a specialised software service provider as a subcontractor. Biehn & Professionals GmbH is contractually obliged to maintain strict confidentiality and to comply with all data protection requirements.

What data protection rights are you entitled to?

You have the right, upon request and free of charge, to receive information about the personal data stored about you, its origin and recipients and the purpose of the data processing. If we process your data on the basis of our legitimate interest, you have the right to object to the processing if there are legitimate reasons arising from your particular situation (right to object). In addition, you have the right to rectification of inaccurate personal data, the right to erasure of personal data, the right to restriction of processing of personal data and the right to data portability. You can contact us at any time with regard to this and other questions on the subject of personal data. Finally, you have the option of lodging a complaint with the supervisory authority if you believe that the processing of your data violates data protection law or your data protection rights have otherwise been violated in any way.

How long will the personal data be stored? 

Personal data is stored for as long as required for clarification and final assessment or as required by law. The information and reports are deleted in accordance with the legal requirements 3 years after the conclusion of the proceedings.